- Same threat actors re-posting victims within several months

- Threat actors posting the same victim organizations on the same date to at least two different leak sites

- Victims being re-posted after several years since the first time victimization

We wanted to look into this more closely to understand why and what type of re-victimizations we are observing. We know by now that the cybercrime ecosystem is a complex one, including many different type of actors, roles and actions. Before we dive into the data, let’s take a moment to talk about the phenomenon of re-victimization and why it is relevant to study. We see different scenarios of victim organizations being re-posted on the darkweb. One of our most urgent questions when looking at possible re-victimization is why we see some victims re-appearing. We have some hypotheses about it:

- Another cyber-attack: An actual, second round of Cyber Extortion / cyber-attack against the same victim has occurred. Either through potentially using the same point of entry or backdoor; or completely unrelated to the first occurrence.

- Re-use of access or data: The victim data has ‘travelled’ (leaked or sold to the underground) and is being used as leverage to try to extort the victim once more. Or the access has been sold to different buyers. Nevertheless, data or access is being re-used.

- Affiliate crossover: An affiliate has reused victim data between different Cy-X operations

We will show some clusters we analyzed between threat actors that are re-posting the same victims and also dive a bit into the “time-delays” between re-victimizations. When do we see occurrences of posting victims not once, not twice but even three times on the dark web. And why it matters also in context what happened to CONTI and affiliates.

Lookout Threat Intelligence has attributed two new Android surveillance malware families tracked as BoneSpy and PlainGnome to the Russian Gamaredon Advanced Persistent Threat group, tied to the Russian Federal Security Service (FSB) by the Security Service of Ukraine (SSU) in 2021. Lookout will present findings of the capabilities of these surveillance families and the factors that led to their attribution to Gamaredon. The purpose of this presentation is to expose these families to the public for the first time, as well as to demonstrate the techniques leading to attribution as well as to communicate mitigations to these threats.
The primary factor tying PlainGnome and BoneSpy to Gamaredon is the strong overlap in command and control (C2) infrastructure hosting. Both mobile families use dynamic DNS provider ddns[.]net for domain registration, while both are hosted on IP address space owned by a single Russian service provider. Multiple IP addresses resolving the mobile C2 also resolve dozens of known Gamaredon C2 domains as well as several others that share the same naming convention. In addition to the direct address space overlap between desktop and mobile campaigns, Gamaredon is known to have used ddns[.]net for domain hosting and typically uses Russian internet service providers for C2. 
Both mobile families targeted former Soviet countries, and contained Russian-language user interface strings. These factors suggest targeting of Russian-speaking victims outside Russia, and generally limited to former Soviet states. Gamaredon has targeted Ukraine extensively since at least 2013, which generally aligns with the threat group’s physical location in occupied Crimea. Gamaredon appeared to target enterprise victims based on use of a BoneSpy sample poorly masquerading as Samsung Knox Manage, used for enterprise mobility management (EMM) and only capable of being installed from sources internal to an organization.

Sponsored Talk | Understand Your Attackers: The Role of Sandboxing in Threat Intelligence

In the face of a rapidly evolving threat landscape, understanding attackers and proactively mitigating threats has become imperative. This technical talk delves into the symbiotic relationship between sandboxing technologies and cyber threat intelligence (CTI), emphasizing the use of dynamic malware analysis to gain a deeper understanding of attackers and fortify organizational defenses. The presentation is structured into four sections:

1. The Significance of Threat Intelligence: This section explores the fundamental reasons for collecting threat intelligence and its practical applications.
2. Choosing the Right Sandbox: Not all sandboxes are created equal. This section provides insights into the selection of a sandboxing solution, considering factors such as integration capabilities, avoiding vendor lock-in, and effective benchmarking.
3. The Value of Indicators of Compromise (IOCs): We discuss the critical role of IOCs in threat intelligence, comparing public and in-house sources, and how they contribute to a comprehensive understanding of threats.
4. Maximizing the Value of Threat Intelligence: The final section focuses on practical applications, demonstrating the effective utilization of threat intelligence, including the automation of threat data collection using platforms like MISP and the deployment of block rules to devices such as routers and proxy servers to prevent threats from advancing.

Handling today’s deluge of malware and phishing attempts may seem overwhelming, but by the end of this session, attendees will have a clear understanding of how to integrate sandboxing technologies into their threat intelligence workflows, enabling a transition from reactive response measures to proactive defense strategies.

The presentation will examine the intent, capability and opportunity enabling threat-actors to conduct successful deepfakes attacks by giving specific details, statistics, and tangible case studies of threat-actors weaponizing deepfakes to target enterprises. The presentation moves far beyond high-profile well-known attacks discussed elsewhere to give you tangible, novel insights from within the last 12 months rooted in Cyber Threat Intelligence data and IR cases.

- Dark-web criminal groups of all calibers - ranking from common fraudsters to high-end ransomware group's - are increasingly weaponizing deepfakes as a method to target individuals and enterprises. While famous case studies include the ‘Hong Kong’ attack resulting in a 25$ million loss are well known, many novel deepfakes attacks have been overlooked.

- Specifically, threat-actors are moving far beyond using deepfakes for BEC, VEC or CEO fraud and are increasingly utilizing it as a tool of enterprise compromise and to enrich technical attack chains, making deepfakes a highly dangerous threat trend for enterprises across geography and operating industry.

- By examining the intent, capability and opportunity of dark-web criminals and their use of deepfakes, the presentation will showcase a significantly changing threat posed by deepfakes, and how it is being utilized by ransomware, extortion and BEC groups alike.

- Several case studies will be examined including by ransomware groups use of deepfakes, VEC attacks as well as examining how c-suites are putting themselves at increased risk, simply by doing their job.

Overall, the research in this presentation is based on 4 years of research and more than 16 case studies. It will examine why the we have seen a more than 205% increase in the purchase of dark-web deepfake service since 2022, how the intend to use the deepfake has changed from fraud to enterprise compromise and how infostealer credentials is helping deliver the deepfake ploys.

Moreover, the large volume of data leaked by ransomware groups is now being used to enrich deepfake attacks by making them more accurate and targeted, an often overlooked threat.

• what were the most impactful events, and
• what lessons should we learn

At the time, it was impossible to predict that this activity was in fact an early sign of what soon became a highly offensive cyber operation that used wipers to wreak havoc and paralyze organizations across the Israeli cyber space. 
The attacks were characterized by three typical phases: 
1.  Initial access and foothold using exploits against vulnerable internet-facing servers 
2. Attempting to steal and exfiltrate highly sensitive data using a custom-built tool
3. Trying to erase evidence and wipe endpoints by deploying three new and undocumented wipers 

Using our telemetry and our attribution methodology, we were able to trace back the steps which the attackers took, analyze their tools, and to finally attribute the attacks to the Iranian Agonizing Serpens (AKA Agrius) APT group. 
Agonizing Serpens (Agrius) first emerged in late 2020, and made it to the news following a series of destructive attacks against multiple Israeli organizations in various industries. 
Our research revealed new TTPs used by the group, which they used in an attempt to step up their game and bypass security mitigations. 
In this talk, we will cover the group's main TTPs, discuss their persistent attempts to bypass EDR and other security measures, and share ways in which security practitioners can learn to identify and defend against destructive wiper attacks.

Sponsored Talk | Hunting for FAMOUS CHOLLIMA

FAMOUS CHOLLIMA have been recruited into a large number of technology, financial services and other organisations across the world. CrowdStrike developed tradecraft, fusing data from multiple domains to hunt them down and evict them from networks. We will explore some of the developments and what others can do to prevent and detect this adversary in their environment.

Sponsored Talk | Defending Today's Secrets from Tomorrow's Attacks
Cryptography is a foundational pillar of security, governing protection of sensitive data at rest, in transit, and providing mechanisms to support authentication of messages and software packages via digital signatures. Many modern cryptographic protocols will be undermined by the emergence of Cryptographically Relevant Quantum Computers, putting sensitive data at risk of collection and rendering controls including software and message signing ineffective. Several solutions have been put forward, including NIST’s Post-Quantum Cryptography (PQC) standardisation effort, which has recently released its first three PQC encryption standards. In this presentation, we will discuss the threat that cryptographically relevant quantum computers pose to cryptography today and in the future. We will also discuss best-practice guidance for transitioning to quantum-resistant technologies that can be actioned immediately to prepare for and initiate a post-quantum cryptographic transformation.